Similar to previous work [1]}, [2]} on certified defenses for multi-class classification, we randomly sample 500 images from the testing (or validation) dataset of each dataset to evaluate our MultiGuard.
